Top Ten PHP Security Hole

[Daniel Tryba]

Re: Top Ten PHP Security Hole

Chung Leong <chernyshevsky@ hotmail.com> wrote:[color=blue]
> I thought a bit more about the GET-vs-POST question and it seems using POST
> for operations that alters data is perhaps preferrable, if only as a mean of
> keeping them separate from data retrieval requests. You can then stop the
> cross-scripting vulne by forbiddening POST operation from a referrer
> different from the current site.[/color]

Using the referrer to secure things.... this one should be in the top 10
also.

--

Daniel Tryba

[Chung Leong]

Re: Top Ten PHP Security Hole


Uzytkownik "David Mackenzie" <me@privacy.net > napisal w wiadomosci
news:04le20tgan alb7c4qdchsf5b9 8hcm4ct9m@4ax.c om...[color=blue]
> But as soon as you request the URL, it will be executed. I was going
> to suggest checking the Content Type, but that has the same problem.[/color]

But the requested action (deleting a message, say) would fail, since the
user is not logged in. You only have the problem when the browser make the
request on behalf of the user. In this case the server would be talking to
itself, so nothing should happen.

[Chung Leong]

Re: Top Ten PHP Security Hole

The assumption is, of course, you don't JUST use the referrer for security
:-)

In this case, as it's quite reasonable to expect that the intended victim
wouldn't spoof the HTTP referrer in order to hijack his own account, I don't
think it's an issue.

Uzytkownik "Daniel Tryba" <news_comp.lang .php@canopus.nl > napisal w
wiadomosci news:c081d4$9g2 $1@news.tue.nl. ..[color=blue]
> Chung Leong <chernyshevsky@ hotmail.com> wrote:[color=green]
> > I thought a bit more about the GET-vs-POST question and it seems using[/color][/color]
POST[color=blue][color=green]
> > for operations that alters data is perhaps preferrable, if only as a[/color][/color]
mean of[color=blue][color=green]
> > keeping them separate from data retrieval requests. You can then stop[/color][/color]
the[color=blue][color=green]
> > cross-scripting vulne by forbiddening POST operation from a referrer
> > different from the current site.[/color]
>
> Using the referrer to secure things.... this one should be in the top 10
> also.
>
> --
>
> Daniel Tryba
>[/color]